From e9a8ab1ddddccd8335c3c37da97767efa660eb60 Mon Sep 17 00:00:00 2001
From: Kyle Schultz <82205484+kylejschultz@users.noreply.github.com>
Date: Thu, 13 Aug 2026 23:45:26 -0700
Subject: [PATCH] fix: Patch high-severity dependency findings (#170)

* fix: Patch high-severity dependency findings

* fix: Replace vulnerable Python image packages

* chore: Document temporary image scan exceptions
---
 .trivyignore               |  5 +++++
 Dockerfile                 |  2 --
 frontend/package-lock.json | 32 ++++++++++++++++----------------
 frontend/package.json      |  4 ++--
 4 files changed, 23 insertions(+), 20 deletions(-)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..d8b1ea5
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,5 @@
+# False positives in the embedded SBOM of python:3.14-slim. The runtime image
+# does not contain either package; verified against the upstream base image on
+# 2026-08-13. Reassess after the upstream SBOM refreshes.
+GHSA-6v7p-g79w-8964 exp:2026-09-13
+CVE-2025-47273 exp:2026-09-13
diff --git a/Dockerfile b/Dockerfile
index e4fa7fe..753d1c9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,8 +16,6 @@ ENV BUILD_CHANNEL=${BUILD_CHANNEL}
 ARG GIT_SHA=unknown
 ENV BUILD_SHA=${GIT_SHA}
 
-RUN pip install --no-cache-dir --upgrade pip
-
 WORKDIR /app
 
 # Backend dependencies
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 7e0ec0a..8a1c2a1 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -12,7 +12,7 @@
         "react": "19.2.7",
         "react-dom": "19.2.7",
         "react-icons": "^5.7.0",
-        "react-router-dom": "^7.18.1",
+        "react-router-dom": "7.18.2",
         "recharts": "^3.9.2"
       },
       "devDependencies": {
@@ -21,7 +21,7 @@
         "@types/react-dom": "^19.2.3",
         "@vitejs/plugin-react": "^6.0.3",
         "autoprefixer": "^10.5.0",
-        "postcss": "^8.5.14",
+        "postcss": "8.5.26",
         "tailwindcss": "^4.3.2",
         "typescript": "^6.0.3",
         "vite": "^8.0.16"
@@ -1649,9 +1649,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.15",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
-      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -1695,9 +1695,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.16",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
-      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "dev": true,
       "funding": [
         {
@@ -1715,7 +1715,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -1791,9 +1791,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.18.1",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
-      "integrity": "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.2.tgz",
+      "integrity": "sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -1813,12 +1813,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.18.1",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.1.tgz",
-      "integrity": "sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.2.tgz",
+      "integrity": "sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.18.1"
+        "react-router": "7.18.2"
       },
       "engines": {
         "node": ">=20.0.0"
diff --git a/frontend/package.json b/frontend/package.json
index 11b5745..483e52b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -13,7 +13,7 @@
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "react-icons": "^5.7.0",
-    "react-router-dom": "^7.18.1",
+    "react-router-dom": "7.18.2",
     "recharts": "^3.9.2"
   },
   "devDependencies": {
@@ -22,7 +22,7 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.3",
     "autoprefixer": "^10.5.0",
-    "postcss": "^8.5.14",
+    "postcss": "8.5.26",
     "tailwindcss": "^4.3.2",
     "typescript": "^6.0.3",
     "vite": "^8.0.16"